A Free Threat
Modeling Tool
ThreatTree's Free plan isn't a trial. Draw data flow diagrams, build attack trees, tag threats with STRIDE and MITRE ATT&CK, and get a scored risk register with PDF export, for up to three systems, in your browser, for as long as you like.
The whole modeling workflow, not a demo of it
The Free plan has the same editors and frameworks as Pro. The limits are on size and teamwork, not on what you can model.
-
Data Flow Diagrams
Processes, data stores, external entities and trust boundaries, including cloud-provider boundaries and AWS elements.
-
Attack Trees
Decompose threats with AND/OR gates down to individual attack steps, linked to the DFD they target.
-
Threat frameworks
STRIDE, LINDDUN, OWASP Top 10 (plus LLM and Agentic), CAPEC, and MITRE ATT&CK and ATLAS technique IDs.
-
Risk register
Likelihood × impact scoring, treatment plans and owners, collected automatically across every attack tree.
-
PDF and JSON export
Export the risk register as a PDF and any diagram as JSON. Your data is never locked in.
-
Client-side encryption
Lock a forest with an AES-256-GCM key generated in your browser. The server only ever stores ciphertext.
What the Free plan doesn't include
We'd rather you know now than find out halfway through a model.
- Size: up to 3 forests (systems), 3 data flow diagrams per forest and 5 attack trees per diagram. Existing models stay fully accessible if you hit a limit; only creating new ones is blocked.
- Teamwork: inviting other people to a forest and company organisations are on Pro.
- Compliance and reporting: standards controls mapping, the full board-ready forest report, STIX 2.1 export, backup snapshots, audit logs and Industry Modules are on Pro.
- Enterprise features: SSO, SCIM, ticketing sync and import from code are on Enterprise.
Pro is $29 per user per month. If you downgrade later, your forests aren't deleted.
Other free threat modeling tools, and when they fit better
ThreatTree isn't the only free option, and it isn't the right one for everybody.
- Microsoft Threat Modeling Tool: a free Windows desktop app that generates a STRIDE threat list for every element. Good for learning STRIDE alone on Windows. How it compares.
- OWASP Threat Dragon: free and open source, runs on the web or desktop, with models stored in Git. Good if you need open source or self-hosting. How it compares.
- AWS Threat Composer: free and open source, built around writing well-structured threat statements, and available in VS Code.
- OWASP pytm and Threagile: free threat-modeling-as-code tools for teams that want models in a repository and a pipeline.
Choose ThreatTree's Free plan if you want attack trees and a scored risk register without installing or hosting anything. For a fuller comparison, read our guide to the best threat modeling software in 2026.
Your first threat model in five steps
Most people finish a first useful model in under an hour.
Create a forest
One forest per system: name it and describe the scope.
Draw the DFD
Components, data flows and the trust boundaries between them. Our DFD guide walks through it.
Walk STRIDE
For each element and flow, ask the six STRIDE questions and note what could go wrong.
Build attack trees
Decompose the threats that matter most, then score each step on likelihood and impact.
Review the register
Decide a treatment for each risk, assign owners, and export the PDF.
The Free plan, answered
What people ask before creating a free account.
Is ThreatTree really free?
Yes. The Free plan has no time limit and needs no credit card. It covers up to 3 forests, each with up to 3 data flow diagrams and 5 attack trees per diagram.
What happens when I hit the Free plan limits?
You'll see a message explaining the limit. Your existing forests and trees stay fully accessible; only creating new ones is blocked until you upgrade or remove something.
Can I use the Free plan for work?
Yes. It has the same editors and frameworks as Pro. What it doesn't have is teamwork and compliance reporting, so when you need to invite colleagues or map mitigations to compliance standards, Pro is $29 per user per month.
Is my data private on the Free plan?
Yes, and you can go further: client-side forest encryption is available on every plan, so the server stores only ciphertext. See the security page.
Do I need to install anything?
No. ThreatTree runs in the browser on Windows, macOS, Linux or ChromeOS.
Start your first threat model free
No credit card, no trial clock, nothing to install.